---
title: "Onboard 10 AEO Client Domains Through an Edge Proxy—Without Waiting on Developers"
description: "A hands-on workflow for routing client sites through an edge proxy, separating verified AI crawler fetches from claimed ones, and sending each client a useful baseline."
url: "https://groas.com/post/onboard-10-client-domains-to-aeo-through"
image: "https://pub-87da24ecbbfc4c3bad6875f3aa013712.r2.dev/generated-images/958879bb-350b-498a-835c-485bf2d6deea.png"
published: "2026-10-14T05:31:34.610Z"
modified: "2026-10-15T15:42:10.644Z"
---

October 14, 2026 · 10 min read

# Onboard 10 AEO Client Domains Through an Edge Proxy—Without Waiting on Developers

[Alexander PerelmanHead Of Product @ groas](https://groas.com/author/alexander-perelman)[LinkedIn](https://www.linkedin.com/in/alexander-433793253/)

Updated October 15, 2026

![Cartoon bouncers guard ten houses from the sidewalk; one eyes a queue where a masked burglar wears the same 'GPTBot' name tag as a real courier.](https://pub-87da24ecbbfc4c3bad6875f3aa013712.r2.dev/generated-images/958879bb-350b-498a-835c-485bf2d6deea.png)

In this article

1. [Before you start: get the DNS owner’s name](#before-you-start-get-the-dns-owners-name)
2. [Step 1: Put all ten domains in one inventory](#step-1-put-all-ten-domains-in-one-inventory)
3. [Step 2: Route the first website through the edge](#step-2-route-the-first-website-through-the-edge)
4. [Step 3: Separate verified crawlers from names in user-agents](#step-3-separate-verified-crawlers-from-names-in-user-agents)
5. [Step 4: Check the files that tell crawlers where to go](#step-4-check-the-files-that-tell-crawlers-where-to-go)
6. [Step 5: Move domains 2–10 in waves](#step-5-move-domains-210-in-waves)
7. [Step 6: Send each client a one-page baseline](#step-6-send-each-client-a-one-page-baseline)
8. [Troubleshoot in this order, not by rewriting content](#troubleshoot-in-this-order-not-by-rewriting-content)
9. [Price the ongoing work per domain, not per prompt](#price-the-ongoing-work-per-domain-not-per-prompt)
10. [Verify the setup, then make the first content change](#verify-the-setup-then-make-the-first-content-change)

Ten signed AEO clients can sit untouched for weeks while an agency waits for ten developers. The first deliverable should not depend on a plugin, a theme edit, or somebody finding time in a sprint.

I used to tell clients the content would fix the visibility. I was wrong about the order. Before changing content, I want to know which AI crawlers fetch the site and which pages they reach. An edge proxy puts that measurement in front of the origin, without changing the site’s code.

**By the end of this workflow, you will have a routed domain and a repeatable way to build a one-page baseline for each client.** Do the hands-on setup for ten domains in an afternoon _if access is ready_; DNS changes and a useful seven-day report take longer. You need a named DNS owner, permission to change nameservers, and about 15 minutes of hands-on work per domain. You do not need CMS admin or a developer.

## Before you start: get the DNS owner’s name

A signed agreement is not DNS access. Ask for everything below on day one, in one email, with a named owner per line:

- `Domain registrar login`: where the domain was bought, and who controls it.
- `DNS host login`, if different: where its records live, and who controls them.
- `Nameserver change approval`: one person who can approve the change in under 24 hours.
- `Site stays where it is`: confirmation that this is edge routing, not a migration or redesign.

No CMS password. No plugin install. The point is to leave the origin alone. [Waiting until launch week to ask for registrar access](https://dev.to/aldobarbosa/why-i-stopped-waiting-until-launch-week-to-ask-clients-for-dns-access-f1j) is how a short setup becomes a two-week search for the person who bought the domain. General onboarding can [stall for weeks on access held outside the sale](https://www.kampaignlab.com/agency-freelance/how-to-onboard-a-new-client-the-right-way). Ask all ten clients now, not one at a time.

**Do not schedule ten routings until ten humans can approve ten DNS changes.** That is the actual prerequisite.

## Step 1: Put all ten domains in one inventory

Open a sheet. Add one row per domain with these exact columns:

```text
domain | registrar | dns_host | cms | dns_owner | proxy_status | verified_bot_7d
```

Fill the first five columns before changing anything. `registrar` is where the domain was bought; `dns_host` is where its records live. They may not be the same account. Set `proxy_status` to `pending_dns`, and leave `verified_bot_7d` blank until you have a seven-day window to count.

```text
clientdomain.com | GoDaddy | Cloudflare | WordPress | Sarah (ops) | pending_dns | —
clientdomain.com | Namecheap | Route53 | Shopify | founder's IT contact | pending_dns | —
```

**Expected result:** ten rows, each with a named, responsive `dns_owner`. The common mistake is entering “IT” or “client” as the owner and discovering later that neither can approve a change. If a name is missing, chase it before moving that domain to Step 2. A spreadsheet cell cannot change nameservers.

## Step 2: Route the first website through the edge

Add the domain to Cloudflare and check its imported DNS records before changing nameservers. At the registrar, replace the current nameservers with the two Cloudflare assigns. Set the website’s `A` and `CNAME` records to `Proxied` (the orange cloud), not `DNS only`. **Proxy the website records, not every record in the zone.**

Run these checks, substituting the client’s domain:

```sh
dig +short NS clientdomain.com
curl -sI https://clientdomain.com | head -5
```

**Expected result:** the nameserver lookup shows the assigned Cloudflare nameservers, the website responds, and the page still loads as it did before. Then confirm the website records show the orange cloud in the edge dashboard. The `curl` response checks that the site responds; it does not, by itself, prove that bot verification is working.

The easy mistake is adding the zone but leaving a website record on `DNS only`. The site still looks fine, which makes this mistake unusually good at hiding. Traffic to that record bypasses the proxy, so your edge measurement misses it. Update `proxy_status` to `active` only after the nameserver, site, and proxy checks pass.

**If the website record’s cloud is gray, you have DNS hosting, not edge routing.** Fix that before looking at a bot chart.

## Step 3: Separate verified crawlers from names in user-agents

Turn on bot measurement at the edge and use its verified-bot signal in the logs you retain. If you pass that signal to the origin, Cloudflare’s [Managed Transform reference](https://developers.cloudflare.com/rules/transform/managed-transforms/reference/) describes the `cf-verified-bot` header. Do not infer verification from the `curl` output or from a user-agent string.

Treat a user-agent as a claim. [Anyone can send `User-Agent: GPTBot/1.4`](https://deepsmith.ai/blog/verify-identify-real-ai-crawler-traffic), and the origin sees the proxy’s IP rather than the crawler’s. That is why [crawler verification belongs at the edge](https://deepsmith.ai/blog/verify-identify-real-ai-crawler-traffic), not in an origin-log reverse-DNS check. In one two-week analysis, [roughly 1 in 17–18 requests claiming to be AI crawlers was spoofed](https://deepsmith.ai/blog/verify-identify-real-ai-crawler-traffic). [groas edge logs found 76.5% of claimed AI bot hits failed verification](https://groas.com/post/76-of-our-ai-bot-traffic-couldn-t-be-ver). The proportions differ; the operational lesson does not.

Filter to verified requests first. Then split them by job. OpenAI identifies [GPTBot for training, OAI-SearchBot for search, and ChatGPT-User for on-demand fetches](https://platform.openai.com/docs/bots). A [published 23.5-hour log sample](https://dev.to/oguzhantusen/i-split-my-sites-ai-bot-traffic-three-ways-only-one-turns-into-a-citation-1113) counted 1,178 training fetches, 541 search-index fetches, and 189 live-answer fetches. A combined “AI bot hits” total would conceal the smaller bucket an AEO client is likely to ask about first.

For the live-answer view, apply the equivalent of this filter to your edge logs:

```text
verified:true AND ua:(ChatGPT-User Perplexity-User Claude-User)
AND status:<400 GROUP BY path ORDER BY liveAnswerHits DESC
```

**Expected result:** a per-page count of successful, verified live-answer fetches. It may be small or zero. Those fetches are a useful _citation proxy_, not proof that an answer cited the page or sent a visitor. A user-agent match alone is weaker still: in a one-day sample across 111 small sites, [1,022 requests claiming ChatGPT-User returned 404, and 69% matched exploit patterns](https://dev.to/lovedbyai/chatgpt-user-in-your-logs-how-to-tell-real-chatgpt-traffic-from-a-scanner-using-its-name-2jbp). The mistake is reporting those claims and errors as audience interest.

If you maintain your own crawler verification lists, [cache the published lists for about an hour rather than hard-coding IPs](https://deepsmith.ai/blog/verify-identify-real-ai-crawler-traffic). Keep the category split in the report: training, search indexing, and live-answer are not interchangeable. **Report verified live-answer fetches per page, not a pile of claimed AI hits.**

## Step 4: Check the files that tell crawlers where to go

Open `https://clientdomain.com/robots.txt` and `https://clientdomain.com/sitemap.xml` from outside the edge. Check the edge log for verified crawler fetches of each path. Look for three familiar surprises: `Disallow: /` left from staging, a crawler block nobody discussed with the client, or a missing sitemap line.

Do not silently remove a training-bot block the client wanted. For an agreed baseline that allows the listed bots, the file could read:

![Agency desk with a laptop set up to route client domains through an edge proxy](https://pub-87da24ecbbfc4c3bad6875f3aa013712.r2.dev/generated-images/7580e819-cad3-40db-bb4b-d8f973ad272f.png)

```text
# robots.txt baseline for AEO measurement
User-agent: GPTBot
Allow: /

User-agent: OAI-SearchBot
Allow: /

User-agent: ChatGPT-User
Allow: /

Sitemap: https://clientdomain.com/sitemap.xml
```

**Expected result:** both file URLs return `200`, their contents match the client’s crawler policy, and verified fetches appear in the log when those crawlers request them. Do not promise a fetch on your timetable. The mistake is reading a blocked or missing file as evidence that the content needs rewriting. If OAI-SearchBot fetches `robots.txt` but not the sitemap, check the sitemap URL and what the file allows before touching page copy.

**Fix access and crawler instructions before writing AEO content.** A blocked crawler can produce a zero baseline even when the page itself is perfectly good.

## Step 5: Move domains 2–10 in waves

Do not finish the first domain’s week-one report before starting the second domain’s routing. Add the domains to the edge, request the approved nameserver changes together, and check each website’s records as its DNS change takes effect. While one client waits on a registrar, verify another site’s proxy status and bot measurement.

Use the same order on every row:

1. Confirm `dns_owner` replied and approved the change.
2. Add the domain and inspect its DNS records.
3. Change nameservers, then set the website records to `Proxied`.
4. Run the `dig` and `curl` checks from Step 2 and load the site.
5. Mark `proxy_status` as `active` only when the checks pass.

At about 15 minutes of hands-on work per domain, ten setups amount to just over two hours of clicks, plus waiting. **That is an afternoon of work, not a guarantee that ten independent DNS changes finish by closing time.**

**Expected result:** active rows for domains whose changes have taken effect; `pending_dns` stays on any that have not. The mistake is calling the whole batch complete because the requests were sent. Your remaining job is mostly chasing the named humans, not configuring servers.

## Step 6: Send each client a one-page baseline

Within seven days of routing, and before changing a page, send one page per domain. [Agree on baseline numbers in writing before changing anything](https://www.kampaignlab.com/agency-freelance/how-to-onboard-a-new-client-the-right-way); otherwise, a later discussion about what moved starts with an argument about the starting line.

Use the same compact format each time:

```text
Domain: clientdomain.com | Week: May 5–12
Verified live-answer hits: 11 (ChatGPT-User 7, Perplexity-User 4)
Top fetched pages: /pricing (5), /compare (3), /faq (2)
Robots/sitemap: 200 / 200 | Blocked: none
```

The top-page line shows the leading pages, not necessarily every hit. Include the window, the verification filter, and the status filter when you explain the counts. If live-answer is zero, write `0`. Do not turn it into a visibility percentage, and do not imply that a verified fetch produced a citation.

**Expected result:** a client can see what was fetched, where, and over what period. The mistake is padding a sparse baseline with training traffic or prompt scores to make week one look busy. A clean zero gives you a starting point; a flattering mixed bucket does not.

## Troubleshoot in this order, not by rewriting content

Three failures account for most stalled setups I see:

1. **No one can approve the DNS change.** Call the named owner from Step 1. Have the client arrange delegated access or put the domain under a registrar they control. A screenshot of DNS records is not permission to change them.
2. **The website still bypasses the proxy.** Recheck the nameservers and the orange cloud on its website records. A loading site is not proof that requests traverse the edge.
3. **Crawler instructions are stale or blocked.** If the edge serves an old `robots.txt` or sitemap, set a short edge TTL or bypass cache for `/robots.txt` and `/sitemap.xml`, purge those paths, and fetch them again. If `robots.txt` says `Disallow: /`, resolve that with the client’s intended crawler policy.

Check DNS ownership first, proxy status second, and crawler instructions third. Then look at the verified log. **Do not sell a content rewrite as the fix for a measurement gap.**

## Price the ongoing work per domain, not per prompt

Prompt caps make an AEO retainer awkward to explain: every additional query you want to track becomes another margin decision. I would price this work per domain and keep the verified-fetch baseline distinct from any prompt-tracking report. They measure different things.

For agencies, groas offers [SEO and AI Search at a flat monthly fee per client domain](https://groas.com/for-agencies), with content, technical fixes, citations, and weekly reporting under the agency’s brand. The [ten-client retainer cost breakdown](https://groas.com/post/what-a-10-client-aeo-retainer-actually-c) covers the wider pricing decision. **Make the domain the unit of the retainer; use the baseline to decide which content work to propose next.** Do not make a client buy a bigger prompt allowance just to understand whether a crawler reached `/pricing`.

## Verify the setup, then make the first content change

Before declaring a domain ready, check three things: `proxy_status` is `active` and the site loads unchanged; edge logs distinguish verified crawlers from claimed ones; and `/robots.txt` and `/sitemap.xml` return `200` with the intended contents. After the reporting window, send the client the written per-page baseline. A zero live-answer count is acceptable. An unverified count presented as verified is not.

Then change one thing: add a quotable block with a specific number, price, or definition to a page with live-answer fetches, and watch its per-page count the following week. If there are no such pages yet, keep the zero in the report rather than inventing a winner.

The developer was not the first bottleneck. **Access was.** Get the DNS owner named on day one, route the site, and show the client what verified crawlers actually fetched before you ask anyone to write another page.

## Frequently Asked Questions

### What access do I need from a client before routing their domain through an edge proxy?

You need the domain registrar login, the DNS host login if it differs, approval from one named person who can approve a nameserver change in under 24 hours, and confirmation that the site stays where it is. You do not need CMS admin access or a developer, because the setup leaves the origin untouched.

### How do I route a client's website through Cloudflare without changing the site's code?

Add the domain to Cloudflare, check its imported DNS records, then replace the registrar's nameservers with the two Cloudflare assigns. Set the website's A and CNAME records to Proxied, not DNS only, and confirm with a dig nameserver lookup and a curl response check.

### Why does my site load fine but my edge bot measurement shows nothing?

The most likely cause is a website record still set to DNS only. The site looks normal, but traffic to that record bypasses the proxy, so the edge measurement misses it. A loading site is not proof that requests traverse the edge, so recheck the nameservers and the orange cloud on the website records.

### How can I tell real AI crawler traffic from spoofed requests?

Treat a user-agent string as a claim only and use the edge proxy's verified-bot signal, such as the cf-verified-bot header. Anyone can send a claimed GPTBot user-agent, and the origin sees the proxy's IP rather than the crawler's, so user-agent matches alone are unreliable.

### Should I report all AI bot hits as one total?

No. Split verified fetches by job: training bots like GPTBot, search bots like OAI-SearchBot, and live-answer fetches from ChatGPT-User, Perplexity-User, or Claude-User. A combined total conceals the smaller live-answer bucket an AEO client is likely to ask about first.

### A crawler gets nothing from the site. Should I rewrite the content?

Check the crawler instructions first. Open robots.txt and sitemap.xml from outside the edge, look for leftovers like Disallow: / from staging or a missing sitemap line, and fix access and crawler instructions before writing AEO content. A blocked crawler can produce a zero baseline even when the page itself is perfectly good.

### What should the first client report look like when onboarding AEO clients?

Within seven days of routing, send a one-page baseline showing verified live-answer hits per page, the top fetched pages, robots and sitemap status, and the reporting window. Write 0 if live-answer fetches were zero, and never present a verified fetch as proof of a citation or visitor.

### Should an AEO retainer be priced per prompt or per domain?

Price the work per domain and keep the verified-fetch baseline distinct from any prompt-tracking report, because they measure different things. Per-prompt pricing makes every additional query a margin decision, and a client should not need a bigger prompt allowance just to know whether a crawler reached a page like /pricing.

## Pay For Results, Not For Hours

Businesses buy the outcome, agencies resell it, and groas answers for it either way.

[See If You Qualify](https://groas.typeform.com/to/xC1bQNUT)

## Structured data

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://graph.groas.com/entity/groas","name":"groas","url":"https://groas.com/","logo":{"@type":"ImageObject","url":"https://groas.com/icon-512.png","width":512,"height":512},"sameAs":["https://www.linkedin.com/company/groas/"]},{"@type":"WebSite","@id":"https://groas.com/#website","name":"groas","url":"https://groas.com/","inLanguage":"en-US","publisher":{"@id":"https://graph.groas.com/entity/groas"}},{"@type":"WebPage","@id":"https://groas.com/post/onboard-10-client-domains-to-aeo-through#webpage","url":"https://groas.com/post/onboard-10-client-domains-to-aeo-through","name":"Onboard 10 AEO Client Domains Through an Edge Proxy—Without Waiting on Developers","description":"A hands-on workflow for routing client sites through an edge proxy, separating verified AI crawler fetches from claimed ones, and sending each client a useful baseline.","inLanguage":"en-US","isPartOf":{"@id":"https://groas.com/#website"},"about":{"@id":"https://graph.groas.com/entity/groas"},"primaryImageOfPage":{"@type":"ImageObject","url":"https://pub-87da24ecbbfc4c3bad6875f3aa013712.r2.dev/generated-images/958879bb-350b-498a-835c-485bf2d6deea.png"},"breadcrumb":{"@id":"https://groas.com/post/onboard-10-client-domains-to-aeo-through#breadcrumb"},"dateModified":"2026-10-15T15:42:10.644Z","mainEntity":{"@id":"https://groas.com/post/onboard-10-client-domains-to-aeo-through#article"}},{"@type":"BreadcrumbList","@id":"https://groas.com/post/onboard-10-client-domains-to-aeo-through#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://groas.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://groas.com/blog"},{"@type":"ListItem","position":3,"name":"Onboard 10 AEO Client Domains Through an Edge Proxy—Without Waiting on Developers","item":"https://groas.com/post/onboard-10-client-domains-to-aeo-through"}]},{"@type":"BlogPosting","@id":"https://groas.com/post/onboard-10-client-domains-to-aeo-through#article","url":"https://groas.com/post/onboard-10-client-domains-to-aeo-through","mainEntityOfPage":{"@id":"https://groas.com/post/onboard-10-client-domains-to-aeo-through#webpage"},"isPartOf":{"@id":"https://groas.com/blog#blog"},"headline":"Onboard 10 AEO Client Domains Through an Edge Proxy—Without Waiting on Developers","description":"A hands-on workflow for routing client sites through an edge proxy, separating verified AI crawler fetches from claimed ones, and sending each client a useful baseline.","datePublished":"2026-10-14T05:31:34.610Z","dateModified":"2026-10-15T15:42:10.644Z","image":{"@type":"ImageObject","url":"https://pub-87da24ecbbfc4c3bad6875f3aa013712.r2.dev/generated-images/958879bb-350b-498a-835c-485bf2d6deea.png"},"author":{"@id":"https://groas.com/author/alexander-perelman#person"},"publisher":{"@id":"https://graph.groas.com/entity/groas"},"keywords":"edge, dns, client, proxy, domain, edge proxy, verified, fetches","wordCount":2058,"inLanguage":"en-US"},{"@type":"Person","@id":"https://groas.com/author/alexander-perelman#person","name":"Alexander Perelman","jobTitle":"Head Of Product @ groas","description":"Ex Goldman Sachs and Ex Stanford Computer Science","image":"https://groas.com/media/blog/4f17cac3a81acc224cc1b2cfab8f94bbc295a3089d13e8421125771ef8d4064f.jpg","worksFor":{"@id":"https://graph.groas.com/entity/groas"},"sameAs":["https://www.linkedin.com/in/alexander-433793253/"]},{"@type":"FAQPage","@id":"https://groas.com/post/onboard-10-client-domains-to-aeo-through#faq","mainEntity":[{"@type":"Question","name":"What access do I need from a client before routing their domain through an edge proxy?","acceptedAnswer":{"@type":"Answer","text":"You need the domain registrar login, the DNS host login if it differs, approval from one named person who can approve a nameserver change in under 24 hours, and confirmation that the site stays where it is. You do not need CMS admin access or a developer, because the setup leaves the origin untouched."}},{"@type":"Question","name":"How do I route a client's website through Cloudflare without changing the site's code?","acceptedAnswer":{"@type":"Answer","text":"Add the domain to Cloudflare, check its imported DNS records, then replace the registrar's nameservers with the two Cloudflare assigns. Set the website's A and CNAME records to Proxied, not DNS only, and confirm with a dig nameserver lookup and a curl response check."}},{"@type":"Question","name":"Why does my site load fine but my edge bot measurement shows nothing?","acceptedAnswer":{"@type":"Answer","text":"The most likely cause is a website record still set to DNS only. The site looks normal, but traffic to that record bypasses the proxy, so the edge measurement misses it. A loading site is not proof that requests traverse the edge, so recheck the nameservers and the orange cloud on the website records."}},{"@type":"Question","name":"How can I tell real AI crawler traffic from spoofed requests?","acceptedAnswer":{"@type":"Answer","text":"Treat a user-agent string as a claim only and use the edge proxy's verified-bot signal, such as the cf-verified-bot header. Anyone can send a claimed GPTBot user-agent, and the origin sees the proxy's IP rather than the crawler's, so user-agent matches alone are unreliable."}},{"@type":"Question","name":"Should I report all AI bot hits as one total?","acceptedAnswer":{"@type":"Answer","text":"No. Split verified fetches by job: training bots like GPTBot, search bots like OAI-SearchBot, and live-answer fetches from ChatGPT-User, Perplexity-User, or Claude-User. A combined total conceals the smaller live-answer bucket an AEO client is likely to ask about first."}},{"@type":"Question","name":"A crawler gets nothing from the site. Should I rewrite the content?","acceptedAnswer":{"@type":"Answer","text":"Check the crawler instructions first. Open robots.txt and sitemap.xml from outside the edge, look for leftovers like Disallow: / from staging or a missing sitemap line, and fix access and crawler instructions before writing AEO content. A blocked crawler can produce a zero baseline even when the page itself is perfectly good."}},{"@type":"Question","name":"What should the first client report look like when onboarding AEO clients?","acceptedAnswer":{"@type":"Answer","text":"Within seven days of routing, send a one-page baseline showing verified live-answer hits per page, the top fetched pages, robots and sitemap status, and the reporting window. Write 0 if live-answer fetches were zero, and never present a verified fetch as proof of a citation or visitor."}},{"@type":"Question","name":"Should an AEO retainer be priced per prompt or per domain?","acceptedAnswer":{"@type":"Answer","text":"Price the work per domain and keep the verified-fetch baseline distinct from any prompt-tracking report, because they measure different things. Per-prompt pricing makes every additional query a margin decision, and a client should not need a bigger prompt allowance just to know whether a crawler reached a page like /pricing."}}]}]}
```